@stratusagent/gateway 0.14.6 → 0.14.8

package/dist/index.js

@@ -6,25 +6,30 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import { mkdir, readFile, rename, rm } from 'node:fs/promises';
-import path from 'node:path';
-import { filePathsOf, isUnaddressedTurn, carriesKey, leastTrusted, senderTrustOf, SENDER_TRUST_METADATA_KEY, workItemState, turnMessageOf, turnKeyOf, leftForNextStart, lastResponseIsAnswer, MAX_IDEMPOTENCY_KEY_LENGTH, recordTurnFailure, completeAnsweredTurn, abortErrorFor, sessionTrustOf, sessionWriteTrust, AgentRegistry, AgentRunner, InMemorySessionStore, MEMORY_PASS_MAX_MODEL_CALLS, MEMORY_PASS_RULES, ChannelRegistry, ContributionRegistry, createRoutedMemoryStore, EventBus, RunAbortedError, SkillRegistry, ToolRegistry, createSkillReadTool, missingSkillRequirements, describeToolAllowlistFinding, unmatchedToolAllowlist, CONTEXT_FLOOR_METADATA_KEY, CONTEXT_SUMMARY_METADATA_KEY, PENDING_APPROVAL_METADATA_KEY, SESSION_TAINTED_BY_METADATA_KEY, SESSION_TRUST_METADATA_KEY, latestTurnReply, readPendingApproval, conversationContextFrom, CONVERSATION_METADATA_KEY, STRATUS_SKILL_ID, imagesWithinReplayBudget, matchesToolAllowlist, resolveToolRisk, } from '@stratusagent/core';
-import { CREDENTIAL_REQUEST_TOOL_NAME, createCredentialRequestTool, createDelegateTool, DELEGATE_TOOL_NAME, createForgetTool, createPinTool, createMessageSendTool, createMessageSayTool, createMessageReadTool, createChannelArchiveTool, createChannelCreateTool, createChannelInviteTool, createChannelJoinTool, directMessageReadRefusal, createRecallTool, createRememberTool, createScheduleTools, DELEGATED_BY_METADATA_KEY, DELEGATED_SESSION_ID_MARKER, DEFAULT_MAX_DELEGATION_DEPTH, DELEGATION_DEPTH_METADATA_KEY, delegatingSessionIdOf, isDelegatedSession, outstandingDelegationFor, ROOT_SESSION_ID_METADATA_KEY, SCHEDULE_ID_METADATA_KEY, SCHEDULED_TURN_METADATA_KEY, withoutDelegation, loadStratusSkill, STRATUS_SKILL_PATH, credentialVariableProblem, } from '@stratusagent/agents';
+import { createHash, randomUUID } from 'node:crypto';
+import { filePathsOf, isUnaddressedTurn, carriesKey, leastTrusted, senderTrustOf, SENDER_TRUST_METADATA_KEY, workItemState, turnMessageOf, turnKeyOf, leftForNextStart, lastResponseIsAnswer, MAX_IDEMPOTENCY_KEY_LENGTH, recordTurnFailure, completeAnsweredTurn, abortErrorFor, sessionTrustOf, sessionWriteTrust, AgentRegistry, AgentRunner, InMemorySessionStore, MEMORY_PASS_MAX_MODEL_CALLS, MEMORY_PASS_RULES, ChannelRegistry, ContributionRegistry, createRoutedMemoryStore, EventBus, RunAbortedError, SkillRegistry, ToolRegistry, createSkillReadTool, missingSkillRequirements, describeToolAllowlistFinding, unmatchedToolAllowlist, PENDING_APPROVAL_METADATA_KEY, SESSION_TRUST_METADATA_KEY, latestTurnReply, readPendingApproval, conversationContextFrom, CONVERSATION_METADATA_KEY, STRATUS_SKILL_ID, imagesWithinReplayBudget, matchesToolAllowlist, resolveToolRisk, } from '@stratusagent/core';
+import { CREDENTIAL_REQUEST_TOOL_NAME, createCredentialRequestTool, createDelegateTool, createForgetTool, createPinTool, createMessageSendTool, createMessageSayTool, createMessageReadTool, createChannelArchiveTool, createChannelCreateTool, createChannelInviteTool, createChannelJoinTool, directMessageReadRefusal, createRecallTool, createRememberTool, createScheduleTools, DELEGATED_BY_METADATA_KEY, DELEGATED_SESSION_ID_MARKER, DEFAULT_MAX_DELEGATION_DEPTH, DELEGATION_DEPTH_METADATA_KEY, delegatingSessionIdOf, isDelegatedSession, outstandingDelegationFor, ROOT_SESSION_ID_METADATA_KEY, SCHEDULE_ID_METADATA_KEY, withoutDelegation, loadStratusSkill, STRATUS_SKILL_PATH, credentialVariableProblem, } from '@stratusagent/agents';
 import { createFleetReader } from "./fleet.js";
 import { createMemoryPassHost } from "./memory-passes.js";
+import { callShownWhole, readReviewReply, REVIEW_RULES, reviewCaseText } from "./review.js";
 import { createEventIntake, summarizeEvents, } from "./event-intake.js";
 import { SqliteEventStore } from "./events.js";
 import { createSchedulerRuntime, isScheduleSessionId, SqliteScheduleStore, SCHEDULE_SESSION_ID_PREFIX, } from "./schedules.js";
 import { ShardedSessionStore } from "./sessions.js";
+import { DEFAULT_CHANNEL_RELOAD_TIMEOUT_MS, DEFAULT_PAUSED_MESSAGE, DEFAULT_RESTART_DRAIN_TIMEOUT_MS, DEFAULT_STOP_DRAIN_TIMEOUT_MS, GatewayStoppingError, HELD_MESSAGE, IntakePausedError, MAX_PAUSED_MESSAGE_LENGTH, PauseMessageError, readIntakeState, RESTARTING_TURN_ERROR, RestartUnsupportedError, STOPPING_TURN_ERROR, writeIntakeState, } from "./lifecycle.js";
+import { ABANDONED_TURN_ERROR, crossIdentityError, CrossIdentityError, DEFAULT_SUB_AGENTS_PER_TURN, EXECUTOR_METADATA_KEY, isSubAgentSession, ORPHANED_DELEGATION_ERROR, RESERVED_SESSION_METADATA_KEYS, reservedSessionMetadataKey, ROLLED_OVER_FROM_METADATA_KEY, ROLLED_OVER_SESSION_ID_MARKER, ROLLED_OVER_TO_METADATA_KEY, ROLLOVER_REPEAT_WINDOW_MS, SUB_AGENT_METADATA_KEY, SUB_AGENT_SESSION_ID_MARKER, subAgentNeverGets, } from "./session-keys.js";
 export { claimHome, homeLockPath, HomeClaimedError, } from "./lock.js";
 export { SqliteSessionStore, ShardedSessionStore, FleetSessionIndex, SessionIdTakenError, tightenSqliteFile, } from "./sessions.js";
 export { SqliteScheduleStore, createSchedulerRuntime, isScheduleSessionId, SCHEDULE_SESSION_ID_PREFIX, } from "./schedules.js";
 export { SqliteEventStore, EVENT_BLOCK_MAX_BYTES, EVENT_DEDUP_WINDOW_MS, EVENT_DELIVERY_ROW_CAP, eventCoalescingKey, eventDispatchKey, eventSessionId, renderEventBlock, } from "./events.js";
+// The review posture's fixed prompt and case, for the review-step eval
+// (`packages/cli/eval/review-step`), which measures the prompt production
+// sends rather than a copy of it.
+export { REVIEW_RULES, readReviewReply, reviewCaseText } from "./review.js";
 export { createEventIntake, mapGithubDelivery, parseStandardWebhookEvent, verifyGithubSignature, verifyStandardWebhookSignature, DEFAULT_EVENT_MAX_BODY_BYTES, EVENT_SOURCE_REQUESTS_PER_MINUTE, } from "./event-intake.js";
 import { createLocalCommandExecutor } from '@stratusagent/executor-local';
 import { loadPlugins, } from '@stratusagent/plugins';
-import { BUILTIN_EXECUTOR_NAME, BUILTIN_MEMORY_STORE_NAME, BUILTIN_PROVIDER_NAMES, createDemoTool, createFileCredentialResolver, resolveDaemonCredential, createHomeMemoryStore, drainSharedMemory, hasBracketedLegacyStateIn, createRuntimeProvider, describeServingModel, DEFAULT_STRATUS_AGENT, isRegisteredProviderName, loadChannelTransportSecrets, registeredProviderNameOf, loadOperatorSkills, loadRosterSouls, FALLBACK_ACTIVE_METADATA_KEY, loadSoulFile, grantSoulCredential, withSoulFileLock, addNamedCredential, appendCredentialAudit, replaceNamedCredential, NamedCredentialMissingError, namedCredentialSource, NamedCredentialExistsError, CREDENTIAL_NAME_PATTERN, quoteShellArg, migrateLegacyMemory, PROVIDER_STATE_METADATA_KEYS, ConfigFileError, loadConfigFile, resolveConfigLocation, resolveConfiguredSoul, resolveRuntimeConfig, runsOnHarness, applySoulPins, assertStateCompatible, unlistedToolsFor, stratusHomePath, intakeStatePath, fleetDbIn, createAgentWorkspaces, createPluginStateDirectories, createHostProtectedPaths, foldedAgentId, syncDirectory, writeFileSynced, } from '@stratusagent/state';
+import { BUILTIN_EXECUTOR_NAME, BUILTIN_MEMORY_STORE_NAME, BUILTIN_PROVIDER_NAMES, createDemoTool, createFileCredentialResolver, credentialValuesFor, resolveDaemonCredential, createHomeMemoryStore, drainSharedMemory, hasBracketedLegacyStateIn, createRuntimeProvider, describeServingModel, DEFAULT_STRATUS_AGENT, isRegisteredProviderName, loadChannelTransportSecrets, registeredProviderNameOf, loadOperatorSkills, loadRosterSouls, FALLBACK_ACTIVE_METADATA_KEY, loadSoulFile, grantSoulCredential, withSoulFileLock, addNamedCredential, appendCredentialAudit, replaceNamedCredential, NamedCredentialMissingError, namedCredentialSource, NamedCredentialExistsError, CREDENTIAL_NAME_PATTERN, quoteShellArg, migrateLegacyMemory, PROVIDER_STATE_METADATA_KEYS, ConfigFileError, loadConfigFile, resolveConfigLocation, resolveConfiguredSoul, resolveRuntimeConfig, runsOnHarness, applySoulPins, assertStateCompatible, unlistedToolsFor, stratusHomePath, fleetDbIn, createAgentWorkspaces, createPluginStateDirectories, createHostProtectedPaths, foldedAgentId, } from '@stratusagent/state';
 const DEFAULT_IDLE_TIMEOUT_MS = 120_000;
 /**
  * How long a parked call waits for a person. Long enough to survive a
@@ -48,142 +53,6 @@ const MAX_TIMER_DELAY_MS = 2_147_483_647;
  * question even when the rule answering it is not gateway code.
  */
 export { applySoulPins } from '@stratusagent/state';
-/** What a turn cut short by an announced restart records as its failure. */
-export const RESTARTING_TURN_ERROR = 'Run aborted: stratusd is restarting';
-/** The error a turn still running when a stop's drain window closes is aborted with. */
-export const STOPPING_TURN_ERROR = 'Run aborted: stratusd is stopping';
-/**
- * How long an announced restart lets in-flight turns finish before aborting
- * them. The same as a stop's window (`DEFAULT_STOP_DRAIN_TIMEOUT_MS`), so the
- * two windows an operator can hit agree.
- */
-export const DEFAULT_RESTART_DRAIN_TIMEOUT_MS = 30_000;
-/** How long a roster reload waits on one channel's `reload()`. */
-export const DEFAULT_CHANNEL_RELOAD_TIMEOUT_MS = 30_000;
-/**
- * How long a stop lets in-flight turns finish before aborting them. The
- * daemon's documented drain ("up to 30 seconds"), and shorter than the
- * service units' stop timeouts, so the abort happens in this process
- * rather than as the manager's SIGKILL. That matters beyond the turn's
- * record: a shell command runs in its own process group, which launchd's
- * kill of the job does not reach, so only the turn's abort stops it.
- */
-export const DEFAULT_STOP_DRAIN_TIMEOUT_MS = 30_000;
-/** What a paused daemon says when nobody gave it a sentence of its own. */
-export const DEFAULT_PAUSED_MESSAGE = "I'm paused right now and not taking new work. Please try again later.";
-/** What a held gateway answers a dispatch with, before it is promoted. */
-export const HELD_MESSAGE = "I'm starting up and not taking work yet. Please try again in a moment.";
-/** The longest pause message, so a reply to a refused message stays one. */
-export const MAX_PAUSED_MESSAGE_LENGTH = 500;
-/** A pause message the gateway will not take: empty, or too long. */
-export class PauseMessageError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'PauseMessageError';
-    }
-}
-/**
- * A dispatch refused because intake is paused. Its message is the sentence
- * to show whoever sent the work, as it is: a channel posts it as the reply,
- * not as a failure.
- */
-export class IntakePausedError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'IntakePausedError';
-    }
-}
-/**
- * A dispatch refused because the daemon is restarting or stopping. Channels
- * stay connected while a restart drains, so they hear people during it, and
- * this is what tells them the message reached a daemon on its way down: a
- * channel can say so and keep the message for the next one. Matched by name
- * there, as channel packages do not import the gateway.
- */
-export class GatewayStoppingError extends Error {
-    /** True for a restart, which comes back on its own; false for a stop. */
-    restarting;
-    constructor(message, restarting) {
-        super(message);
-        this.name = 'GatewayStoppingError';
-        this.restarting = restarting;
-    }
-}
-/**
- * The intake state a previous process left, or open when there is none.
- *
- * Fails closed: a file that exists but cannot be read or parsed starts the
- * daemon paused, with a warning naming it. A pause exists to stop work (a
- * spending cap, a maintenance window), and a file nobody can read is no
- * evidence that it was lifted.
- */
-const readIntakeState = async (env, warn) => {
-    const file = intakeStatePath(env);
-    let raw;
-    try {
-        raw = await readFile(file, 'utf8');
-    }
-    catch (error) {
-        if (error.code === 'ENOENT') {
-            return { paused: false };
-        }
-        warn(`intake: ${file} could not be read (${error.message}); starting paused. Resume intake to clear it.`);
-        return { paused: true, since: new Date().toISOString(), unreadable: true };
-    }
-    try {
-        const parsed = JSON.parse(raw);
-        // Only a pause is ever written here (resuming removes the file), so
-        // anything else in it is not a record this build wrote, and the same
-        // rule as an unreadable file applies.
-        if (typeof parsed !== 'object' || parsed === null || parsed.paused !== true) {
-            warn(`intake: ${file} does not hold a pause record; starting paused. Resume intake to clear it.`);
-            return { paused: true, since: new Date().toISOString(), unreadable: true };
-        }
-        return {
-            paused: true,
-            ...(typeof parsed.message === 'string' && parsed.message.trim().length > 0 ? { message: parsed.message } : {}),
-            since: typeof parsed.since === 'string' ? parsed.since : new Date().toISOString(),
-        };
-    }
-    catch {
-        warn(`intake: ${file} is not valid JSON; starting paused. Resume intake to clear it.`);
-        return { paused: true, since: new Date().toISOString(), unreadable: true };
-    }
-};
-/**
- * Record a pause durably (0600, replaced in one atomic step), or remove the
- * record when intake reopens: open is the default, so nothing on disk
- * means open.
- */
-const writeIntakeState = async (env, state) => {
-    const file = intakeStatePath(env);
-    if (!state.paused) {
-        await rm(file, { force: true });
-        return;
-    }
-    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-    const staging = `${file}.${randomBytes(8).toString('hex')}`;
-    try {
-        await writeFileSynced(staging, `${JSON.stringify(state)}\n`, { flag: 'wx', mode: 0o600 });
-        await rename(staging, file);
-        await syncDirectory(path.dirname(file));
-    }
-    finally {
-        await rm(staging, { force: true });
-    }
-};
-/**
- * `restart()` on a gateway whose host gave it no way back. Exported so the
- * control API can answer it as "not supported here" rather than as a
- * failure of the daemon.
- */
-export class RestartUnsupportedError extends Error {
-    constructor() {
-        super('This daemon cannot restart itself: the host that started it did not say how. '
-            + 'Restart it from the service manager (stratus service stop, then start) or from the terminal it runs in.');
-        this.name = 'RestartUnsupportedError';
-    }
-}
 /**
  * The most text one merged user message may hold (card 423). The runner's
  * overflow recovery can drop earlier transcript but never part of the
@@ -253,143 +122,6 @@ const formCredentialValue = (value) => value.replace(/^[\r\n]+|[\r\n]+$/g, '');
  * so it has none of its own and is fine as sent.
  */
 const isFlattenedPem = (value) => /^\s*-----BEGIN [A-Z0-9 ]+-----/.test(value) && !value.includes('\n');
-/**
- * Recorded on a turn the previous process was still running when it died.
- *
- * Exported because "distinguishable" is the whole point: a surface, a
- * test, or an operator reading `lastError` has to be able to tell a turn
- * nobody finished apart from one a provider or a tool actually failed, and
- * matching on prose that lives in one place beats each caller inventing
- * its own guess at the wording.
- */
-export const ABANDONED_TURN_ERROR = 'stratusd stopped while this turn was still running; it was not resumed. Send the message again.';
-/**
- * The longest `DispatchInput.idempotencyKey` accepted. A platform message id
- * is far shorter; the bound is so a key cannot be used to grow every row it
- * is stored on.
- */
-/**
- * Recorded on a delegated sub-session that was parked on a human when the
- * previous process died.
- *
- * Its parent — the turn whose `agent.delegate` call was awaiting the reply
- * — was running, so the restart settles it as abandoned (above). Recovering
- * the child anyway would re-ask a person to approve a call whose result no
- * turn will ever read, and then run it: a command executed, tokens spent,
- * and a reply delivered to nobody. Distinguishable from the parent's error
- * because the remedy differs — there is no message to send again here;
- * the parent's is the one to repeat.
- */
-/**
- * Session metadata keys the daemon writes for itself, which no external
- * dispatch may supply.
- *
- * Metadata is one bag: the keys a channel attaches to say where a turn is
- * happening sit beside the ones the kernel, the scheduler, the fallback
- * wrapper, and `agent.delegate` write to remember what a session *is* —
- * and the control API forwards a caller's `metadata` into a new session as
- * given. A caller who can write `delegatedBy` can have the restart sweep
- * fail its own parked turn as an orphan; one who can write `fallbackActive`
- * bills its conversation to the fallback model from the first turn. The
- * scheduler already refused to trust its own keys for exactly this reason
- * (see `activeFirings`); the durable ones cannot be re-derived in memory,
- * so they are refused at the door instead.
- */
-/**
- * A rolled-over session: the fresh row records where its predecessor's
- * transcript went, and the archived row records which live id continues
- * the conversation. See `Gateway.rolloverSession`.
- */
-export const ROLLED_OVER_FROM_METADATA_KEY = 'rolledOverFrom';
-export const ROLLED_OVER_TO_METADATA_KEY = 'rolledOverTo';
-/** The segment a rollover mints into the archived transcript's id. */
-export const ROLLED_OVER_SESSION_ID_MARKER = ':rolledover:';
-/**
- * How long after a rollover a repeated key is still looked for in the
- * archived transcript. A rollover moves every keyed message out of the
- * live row, so a redelivery arriving after one would otherwise read as a
- * new message and run again. Platforms redeliver within minutes — Slack
- * gives up after about five — and past the window the archive is not
- * loaded at all, since every new message to the fresh row would pay for a
- * read that can no longer find anything.
- */
-const ROLLOVER_REPEAT_WINDOW_MS = 60 * 60 * 1000;
-/**
- * The one refusal for a dispatch naming an agent other than its session's.
- * Its own type so a repeat attached to a claimant can tell the claimant was
- * refused for who it named — the item then still has no owner — from the
- * claimant's turn failing. Internal: callers read the message.
- */
-class CrossIdentityError extends Error {
-    constructor(sessionId, owner, claimed) {
-        super(`Session ${sessionId} belongs to agent ${owner}, not ${claimed} — sessions never cross agent identities.`);
-        this.name = 'CrossIdentityError';
-    }
-}
-const crossIdentityError = (sessionId, owner, claimed) => new CrossIdentityError(sessionId, owner, claimed);
-/** Where the session's tool calls ran: `local-command`, or a contributed executor's registered name. */
-export const EXECUTOR_METADATA_KEY = 'executor';
-/**
- * Marks a sub-agent's session (roadmap 24). Reserved: it is what makes the
- * daemon deny the session's gated calls without asking anyone, so a caller
- * that could set it could also clear it.
- */
-export const SUB_AGENT_METADATA_KEY = 'subAgent';
-export const SUB_AGENT_SESSION_ID_MARKER = ':subagent:';
-/** How many sub-agents one parent turn runs at once unless the host says otherwise. */
-export const DEFAULT_SUB_AGENTS_PER_TURN = 4;
-export const isSubAgentSession = (session) => session.metadata?.[SUB_AGENT_METADATA_KEY] === true && session.id.includes(SUB_AGENT_SESSION_ID_MARKER);
-/**
- * Tools a sub-agent never gets, whatever its parent holds. `agent.spawn`
- * would fan out inside a fan-out; `agent.delegate` runs a roster agent
- * under that agent's own allowlist, which is the way out of a narrowed
- * slice; `memory.*` would let it persist what nobody reviewed; and
- * `credential.request` asks a person, which a sub-agent never does.
- */
-const subAgentNeverGets = (name) => name === 'agent.spawn'
-    || name === DELEGATE_TOOL_NAME
-    || name.startsWith('memory.')
-    || name === CREDENTIAL_REQUEST_TOOL_NAME;
-export const RESERVED_SESSION_METADATA_KEYS = [
-    PENDING_APPROVAL_METADATA_KEY,
-    FALLBACK_ACTIVE_METADATA_KEY,
-    DELEGATED_BY_METADATA_KEY,
-    ROOT_SESSION_ID_METADATA_KEY,
-    DELEGATION_DEPTH_METADATA_KEY,
-    SCHEDULED_TURN_METADATA_KEY,
-    SCHEDULE_ID_METADATA_KEY,
-    // The trust label is the runner's to write and only ever goes down; a
-    // caller who could seed it would be seeding it upward.
-    SESSION_TRUST_METADATA_KEY,
-    SESSION_TAINTED_BY_METADATA_KEY,
-    ROLLED_OVER_FROM_METADATA_KEY,
-    ROLLED_OVER_TO_METADATA_KEY,
-    // Which executor ran the turn's tool calls is the daemon's record of
-    // where a command ran, and the one audit question a caller must not be
-    // able to answer for it.
-    EXECUTOR_METADATA_KEY,
-    // The context floor is an index into a specific transcript, so it means
-    // nothing next to a different one. Reserved for both halves of that: a
-    // caller cannot seed it, and a rollover drops it with the transcript it
-    // indexed — otherwise the fresh session inherits an absolute floor over
-    // no messages and, once it grows past that index, silently stops sending
-    // its own earliest turns, with no overflow and no trim event to say so.
-    CONTEXT_FLOOR_METADATA_KEY,
-    // The summary that stands in below that floor, for both of the same
-    // reasons, and one more: the model reads it as something it wrote itself,
-    // so a caller who could seed it could put words in the agent's mouth.
-    CONTEXT_SUMMARY_METADATA_KEY,
-    SUB_AGENT_METADATA_KEY,
-];
-/**
- * The first reserved key `metadata` carries, or undefined when it carries
- * none. Exported so the control API can refuse the request where the
- * caller can see it, with the same rule the gateway applies at dispatch.
- */
-export const reservedSessionMetadataKey = (metadata) => metadata === undefined
-    ? undefined
-    : RESERVED_SESSION_METADATA_KEYS.find((key) => Object.prototype.hasOwnProperty.call(metadata, key));
-export const ORPHANED_DELEGATION_ERROR = 'stratusd stopped while the turn that delegated this one was still running; the delegation was not resumed. Send the original message again.';
 /**
  * The always-on Stratus process. One gateway holds the roster, the durable
  * session store, the shared event bus, and a pool of runners keyed by
@@ -766,6 +498,7 @@ export const createGateway = (options = {}) => {
                 ...(request.origin !== undefined ? { origin: request.origin } : {}),
                 ...(oneShot ? { oneShot: true } : {}),
                 ...(always !== undefined ? { always } : {}),
+                ...(request.reviewNote !== undefined ? { reviewNote: request.reviewNote } : {}),
                 parkedAt: request.parkedAt ?? new Date().toISOString(),
                 ...(expiresAt ? { expiresAt } : {}),
                 ...(request.session.metadata ? { metadata: request.session.metadata } : {}),
@@ -816,6 +549,7 @@ export const createGateway = (options = {}) => {
             ...(request.origin !== undefined ? { origin: request.origin } : {}),
             ...(oneShot ? { oneShot: true } : {}),
             ...(always !== undefined ? { always } : {}),
+            ...(request.reviewNote !== undefined ? { reviewNote: request.reviewNote } : {}),
             ...(request.session.metadata ? { metadata: request.session.metadata } : {}),
             ...(delegatedFrom ? { delegatedFrom } : {}),
             ...(scheduleDestination ? { scheduleDestination } : {}),
@@ -886,6 +620,17 @@ export const createGateway = (options = {}) => {
     const configuredApprovals = typeof options.approvals === 'function'
         ? options.approvals({
             request: requestApproval,
+            // Late-bound: the side call is built further down this function.
+            review: (request) => reviewCall(request),
+            // Rejects when the soul or the credential store can't be read: the
+            // permission engine then asks a person, rather than checking the
+            // call against no secrets at all.
+            secretsFor: async (agentId) => {
+                const { definition } = await refreshAgent(agentId);
+                return credentialValuesFor(createFileCredentialResolver(env), definition);
+            },
+            // Late-bound like `review`: the set is declared with the side call.
+            offPath: (task) => keepUntilStopped(task),
             destinations: {
                 isPreauthorized: (session, destination) => scheduler.isPreauthorized(session, destination),
                 accountFor: (agentId, destination) => {
@@ -2760,6 +2505,25 @@ export const createGateway = (options = {}) => {
      * session sufficient.
      */
     const activeTurns = new Map();
+    /**
+     * The runtime each running turn resolved when it started, by session. A
+     * reviewer call for one of its calls runs on it (`reviewCall`), so a soul
+     * or config edited mid-turn can't send that turn's request to a provider
+     * that wasn't serving it. Exact for the same reason `activeTurns` is: one
+     * turn per session at a time, set and cleared inside the session chain.
+     */
+    const turnRuntimes = new Map();
+    const onTurnRuntime = async (sessionId, runtime, work) => {
+        turnRuntimes.set(sessionId, runtime);
+        try {
+            return await work();
+        }
+        finally {
+            if (turnRuntimes.get(sessionId) === runtime) {
+                turnRuntimes.delete(sessionId);
+            }
+        }
+    };
     /**
      * Keyed dispatches not yet settled, by session and key — what a repeat
      * attaches to. In memory on purpose: it only has to cover the turns this
@@ -2981,7 +2745,7 @@ export const createGateway = (options = {}) => {
         // has switched for good, the primary is never called again, and only
         // the fallback counts.
         const hostedLoop = input.idempotencyKey !== undefined && reachesHarness(config, switchedToFallback);
-        return settleLeftForNextStart(input, withWatchdog(input.sessionId, input.signal, effectiveStreams, fallbackStreams, async (signal) => {
+        return settleLeftForNextStart(input, onTurnRuntime(input.sessionId, { source, config }, () => withWatchdog(input.sessionId, input.signal, effectiveStreams, fallbackStreams, async (signal) => {
             // The preflight above (agent refresh, config resolution, session
             // load) awaited filesystem work; the entry check has long passed.
             // Recheck before the runner touches durable state, or a dispatch
@@ -3064,7 +2828,7 @@ export const createGateway = (options = {}) => {
                 ...(steer !== undefined ? { steer: () => steer(signal) } : {}),
                 signal,
             });
-        }));
+        })));
     };
     /**
      * Finishes the turns that were parked on a human when this daemon last
@@ -3235,11 +2999,11 @@ export const createGateway = (options = {}) => {
                 }
             }
             try {
-                await runner.recoverPendingApproval(sessionId, {
+                await onTurnRuntime(sessionId, { source, config: recoveredConfig }, () => runner.recoverPendingApproval(sessionId, {
                     denyPending: expired,
                     runtime: runtimeContextFor(source, recoveredConfig, session.metadata?.[FALLBACK_ACTIVE_METADATA_KEY] === true, session.metadata),
                     signal: controller.signal,
-                });
+                }));
             }
             finally {
                 untrackTurn(sessionId, controller);
@@ -3449,10 +3213,10 @@ export const createGateway = (options = {}) => {
         session.agent = source.definition;
         await store.save(session);
         const runner = runnerFor(config, source.definition.id);
-        return withWatchdog(session.id, undefined, effectiveStreams, fallbackStreams, async (signal) => await runner.continueTurn(session.id, {
+        return onTurnRuntime(session.id, { source, config }, () => withWatchdog(session.id, undefined, effectiveStreams, fallbackStreams, async (signal) => await runner.continueTurn(session.id, {
             runtime: runtimeContextFor(source, config, switchedToFallback, session.metadata),
             signal,
-        }) ?? session);
+        }) ?? session));
     };
     /**
      * A repeated idempotency key that reached the session's chain, so nothing
@@ -3686,6 +3450,8 @@ export const createGateway = (options = {}) => {
         return turn;
     };
     // ---- memory passes (spec 962) -------------------------------------------
+    /** The session ids of the side runs running now: reviewer calls and memory passes. */
+    const sideRuns = new Set();
     /**
      * A pass's one model turn: the agent's provider and credentials, exactly
      * the model asked for and never the fallback (cost stays what the
@@ -3694,18 +3460,16 @@ export const createGateway = (options = {}) => {
      * go through the same provider-call guards as every turn, and its events
      * through the same bus, so a budget sees and counts them.
      */
-    const runMemoryPassModel = async (run) => {
-        const source = await refreshAgent(run.agentId);
-        const resolved = await runtimeForAgent(source);
+    const runSideModel = async (run) => {
+        const source = run.runtime?.source ?? await refreshAgent(run.agentId);
+        const resolved = run.runtime?.config ?? await runtimeForAgent(source);
         const { fallback: _fallback, ...primary } = resolved;
         const config = (run.model !== undefined ? { ...primary, model: run.model } : primary);
         const tools = new ToolRegistry();
         for (const tool of run.tools) {
             tools.register(tool);
         }
-        // A step budget of n is n tool steps and one wrap-up, so this is the
-        // pass's model-call cap.
-        const maxTurns = MEMORY_PASS_MAX_MODEL_CALLS - 1;
+        const { maxTurns } = run;
         let passRunner;
         const provider = createRuntimeProvider(config, () => { }, async (session, call, context) => {
             if (!passRunner) {
@@ -3724,25 +3488,126 @@ export const createGateway = (options = {}) => {
         const definition = {
             id: source.definition.id,
             name: source.definition.name,
-            instructions: MEMORY_PASS_RULES,
+            instructions: run.instructions,
             tools: run.tools.map((tool) => tool.name),
             skills: [],
             delegates: [],
             ...(source.definition.credentials !== undefined ? { credentials: [...source.definition.credentials] } : {}),
         };
-        await passRunner.run({
+        // Its events go on the shared bus like a turn's, for what counts provider
+        // calls there (`session.usage`), and are known as a side run's for as
+        // long as it runs (`isSideRun`), so a surface that shows conversations
+        // can leave it out.
+        sideRuns.add(run.sessionId);
+        try {
+            return await passRunner.run({
+                sessionId: run.sessionId,
+                agent: definition,
+                userMessage: run.prompt,
+                metadata: {
+                    provider: config.provider,
+                    ...(config.provider !== 'demo' && config.model !== undefined ? { model: config.model } : {}),
+                    [SENDER_TRUST_METADATA_KEY]: run.trust,
+                },
+                signal: run.signal,
+            });
+        }
+        finally {
+            sideRuns.delete(run.sessionId);
+        }
+    };
+    const runMemoryPassModel = async (run) => {
+        await runSideModel({
+            agentId: run.agentId,
             sessionId: run.sessionId,
-            agent: definition,
-            userMessage: run.prompt,
-            metadata: {
-                provider: config.provider,
-                ...(config.provider !== 'demo' && config.model !== undefined ? { model: config.model } : {}),
-                // The slice's label: the pass reads at the conversation's trust.
-                [SENDER_TRUST_METADATA_KEY]: run.trust,
-            },
+            model: run.model,
+            instructions: MEMORY_PASS_RULES,
+            prompt: run.prompt,
+            // The slice's label: the pass reads at the conversation's trust.
+            trust: run.trust,
+            tools: run.tools,
+            // A step budget of n is n tool steps and one wrap-up, so this is the
+            // pass's model-call cap.
+            maxTurns: MEMORY_PASS_MAX_MODEL_CALLS - 1,
             signal: run.signal,
         });
     };
+    // ---- the review posture's reviewer (spec 964) ----------------------------
+    /**
+     * Reviewer calls still running, and the shadow reviews the policy hands
+     * over whole (`ApprovalTransport.offPath`). A turn awaits its own, but a
+     * shadow review runs off the call path and can outlast its turn, still
+     * reading credentials before its reviewer call starts, and a provider
+     * that ignores its abort after the review's timeout keeps one going with
+     * nothing waiting on it. A shutdown aborts these once the turns have
+     * drained and waits for them, so none is still using a provider when the
+     * plugins are disposed, and no decision they report is lost.
+     */
+    const reviewsRunning = new Set();
+    const stopReviews = new AbortController();
+    const keepUntilStopped = (task) => {
+        reviewsRunning.add(task);
+        const untrack = () => {
+            reviewsRunning.delete(task);
+        };
+        task.then(untrack, untrack);
+    };
+    const reviewCall = async (request) => {
+        if (request.command !== undefined && !callShownWhole(request.call)) {
+            // A command line the case can't show whole could hide its end, and
+            // the reviewer would judge only the part it saw: a person decides.
+            return { failed: 'command-too-long' };
+        }
+        const firing = scheduler.firingPromptFor(request.session);
+        const prompt = reviewCaseText({
+            session: request.session,
+            call: request.call,
+            tool: request.tool,
+            risk: request.risk,
+            ...(request.command !== undefined ? { command: request.command } : {}),
+            ...(request.origin !== undefined ? { origin: request.origin } : {}),
+            ...(request.destination !== undefined ? { destination: request.destination } : {}),
+            ...(firing !== undefined ? { firing } : {}),
+            delegated: isSubAgentSession(request.session),
+        });
+        if (stopReviews.signal.aborted) {
+            return { failed: 'cancelled' };
+        }
+        const signal = AbortSignal.any([request.signal, stopReviews.signal]);
+        // On the reviewed turn's own runtime while it runs. A review after it
+        // has ended (a shadow review can outlast its turn) takes the agent's
+        // current one, which is where the session's next turn sends the same
+        // conversation anyway.
+        const runtime = turnRuntimes.get(request.session.id);
+        const running = runSideModel({
+            agentId: request.session.agent.id,
+            sessionId: `review:${randomUUID()}`,
+            model: request.model,
+            instructions: REVIEW_RULES,
+            prompt,
+            // The case quotes a call an outside page may have shaped.
+            trust: 'external',
+            tools: [],
+            maxTurns: 1,
+            signal,
+            ...(runtime !== undefined ? { runtime } : {}),
+        });
+        keepUntilStopped(running);
+        let answered;
+        try {
+            answered = await running;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return { failed: /budget/i.test(message) ? 'budget' : signal.aborted ? 'cancelled' : 'provider-error' };
+        }
+        if (answered.status === 'failed') {
+            return { failed: signal.aborted ? 'cancelled' : 'provider-error' };
+        }
+        const reply = [...answered.messages].reverse().find((message) => message.role === 'assistant' && message.content.trim().length > 0);
+        const parsed = reply === undefined ? undefined : readReviewReply(reply.content);
+        return parsed === undefined ? { failed: 'unparseable' } : { reply: parsed };
+    };
     const memoryPassHost = createMemoryPassHost({
         // Beside each agent's memory.jsonl, under the home the memory store uses.
         stateDir: stratusHomePath(env),
@@ -4817,6 +4682,12 @@ export const createGateway = (options = {}) => {
             while (inflight.size > 0) {
                 await Promise.allSettled([...inflight]);
             }
+            // Then the reviews no turn is waiting on: aborted rather than drained,
+            // since what they report is about turns already over, and waited for.
+            stopReviews.abort(new Error('The daemon is stopping.'));
+            while (reviewsRunning.size > 0) {
+                await Promise.allSettled([...reviewsRunning]);
+            }
             // Then the channels, whose stop awaits the rendering they still have
             // in flight: the outcomes of the turns that just finished.
             await stopChannels();
@@ -4847,6 +4718,7 @@ export const createGateway = (options = {}) => {
             // Before the loop, so a turn queued behind one aborted here, which
             // starts as soon as that one settles, is aborted the same way.
             abortingWith = kind === 'stop' ? STOPPING_TURN_ERROR : RESTARTING_TURN_ERROR;
+            stopReviews.abort(new Error('The daemon is stopping.'));
             for (const running of turnControllers.values()) {
                 for (const controller of running) {
                     controller.abort(shutdownAbort());
@@ -5178,6 +5050,9 @@ export const createGateway = (options = {}) => {
         activeTurnId(sessionId) {
             return activeTurns.get(sessionId);
         },
+        isSideRun(sessionId) {
+            return sideRuns.has(sessionId);
+        },
         abortTurns(sessionId, reason) {
             const running = turnControllers.get(sessionId) ?? new Set();
             for (const controller of running) {
@@ -5239,11 +5114,18 @@ export const createGateway = (options = {}) => {
             const provenanceByName = toolProvenance();
             return tools.describe().map((descriptor) => {
                 const provenance = provenanceByName.get(descriptor.name);
+                const tool = tools.get(descriptor.name);
+                const hooks = [
+                    ['command', tool?.commandFor],
+                    ['origin', tool?.originFor],
+                    ['destination', tool?.destinationFor],
+                ].filter(([, hook]) => hook !== undefined).map(([name]) => name);
                 return {
                     name: descriptor.name,
                     ...(descriptor.description ? { description: descriptor.description } : {}),
                     risk: descriptor.risk ?? 'gated',
                     ...(provenance ? { package: provenance.package, trusted: provenance.trusted } : {}),
+                    ...(hooks.length === 1 ? { scopedBy: hooks[0] } : {}),
                 };
             });
         },
@@ -5389,4 +5271,8 @@ export const createGateway = (options = {}) => {
     };
     return gateway;
 };
+// Restart, stop and pause, in their own module (see the top of lifecycle.ts).
+export { DEFAULT_CHANNEL_RELOAD_TIMEOUT_MS, DEFAULT_PAUSED_MESSAGE, DEFAULT_RESTART_DRAIN_TIMEOUT_MS, DEFAULT_STOP_DRAIN_TIMEOUT_MS, GatewayStoppingError, HELD_MESSAGE, IntakePausedError, MAX_PAUSED_MESSAGE_LENGTH, PauseMessageError, RESTARTING_TURN_ERROR, RestartUnsupportedError, STOPPING_TURN_ERROR, } from "./lifecycle.js";
+// Reserved session keys and markers, in their own module (see the top of session-keys.ts).
+export { ABANDONED_TURN_ERROR, DEFAULT_SUB_AGENTS_PER_TURN, EXECUTOR_METADATA_KEY, isSubAgentSession, ORPHANED_DELEGATION_ERROR, RESERVED_SESSION_METADATA_KEYS, reservedSessionMetadataKey, ROLLED_OVER_FROM_METADATA_KEY, ROLLED_OVER_SESSION_ID_MARKER, ROLLED_OVER_TO_METADATA_KEY, SUB_AGENT_METADATA_KEY, SUB_AGENT_SESSION_ID_MARKER, } from "./session-keys.js";
 //# sourceMappingURL=index.js.map